A monitoring system that monitors node apparatuses such as server, storage, network apparatuses, and detects events such as failures or status changes occurred on a monitoring target node apparatus, and analyzes a root cause of the detected events, is known. (See Patent Citation 1, for example).
For example, the monitoring system calculates a degree of confidence indicating probability that each conclusion is a cause based on the plural rules (“Event cause information,” hereafter) indicating correspondence relationship between one or more condition events regarding any of the plurality of node apparatuses, and a conclusion to be the cause in the case where one or more condition events have occurred and the existence of detection of the condition events on a root cause analysis. For example, a degree of confidence on some conclusion is a ratio of the number of condition events detected by the monitoring system among the condition events associated with the conclusion to the total number of events associated with the conclusion. The monitoring system extracts candidates of a cause based on the calculated degree of confidence and displays result of a cause analysis including them. An administrator refers to the result of a cause analysis displayed on the monitoring system and estimates the root cause.